Evolution of BP’s self-verification encompasses digital app, targeting of barriers at component level

By Linda Hsieh, Editor and Publisher

Over the past decade, self-verification has come to play a significant role within BP’s Wells organization when it comes to mitigating major accident risk. The program has been continuously updated and enhanced through the addition of barrier enablers and barrier owners, the development of a digital self-verification app, and the targeting of barriers at a component level. This work was detailed in a presentation at the 2021 SPE/IADC International Drilling Conference in March.

“Our Wells organization manages operational risk through what is known as a ‘three lines of defense’ model,” said Roman Bulgachev, BP’s Risk Advisor for the Production & Operations Organization. He previously served as Wells Self-Verification Program Lead and Risk Advisor for the North Sea and Africa.

“The first line of defense is self-verification, which is conducted by our assets to verify conformance with requirements and technical standards,” he explained. 

BP considers three perspectives when it comes to self verifications, Mr Bulgachev explained.

First, the engineering perspective is conducted by Wells engineers and engineering team leaders to verify that the well design and engineering work are delivered within technical standards.

Second, operational verification is conducted by wellsite leaders and regional operational leaders during the execution of well activities to verify effectiveness.

Finally, there is rig verification, which is conducted by teams of “verifiers” who visit the rigs and intervention vessels prior to contract, pre-startup, and during ongoing operations. “During these visits, the rig verifiers conduct deep technical verification of applicable barriers through the lens of people, process and plant. The resulting actions are verified ‘closed’ by the rig verification team,” Mr Bulgachev said.

At the core of the self-verification program is the barrier management approach, which helps to visualize and manage major accident risks. Using the bowtie model, the hazard and risk events are placed in the middle, while the cause legs are shown on the left and consequence legs on the right.

BP’s standard bowties for its nine identified major accident risks were first revised in 2012 so that they – for the first time – reflected the complexity of well operations, Mr Bulgachev said. For example,  the “loss of well control during well construction” bowtie contained 29 barriers across eight cause legs, plus 12 barriers across two consequence legs.

Checklists were developed to help personnel conduct self-verification of barrier health. Further, BP established the roles of regional self-verification champions and a central self-verification program lead.

All Wells regions set up their own annual self-verification plans. “The plans are developed regionally and signed off by the Wells vice presidents to demonstrate regional commitment to deliver the plans,” Mr Bulgachev described. “The regional champions will look after the health and delivery of the program.”

Further, all barriers were assigned an “owner,” or technical experts who could assist with barrier design and reviews. These owners also help to establish common gaps and solutions across BP. “If there are 10 common gaps on 10 different rigs, we don’t want them to be solved in 10 different ways,” Mr Bulgachev said.

Over time, the barrier self-verification process became integrated into operational routines. For example, assessment results were reviewed during weekly meetings between wellsite leaders and contractor onsite leaders.  Monthly meetings with contractors’ senior personnel also included reviews of self-verification results and identified gaps.

However, within a few years, BP saw the need for a second revision. “As we became more mature in our use of bowties, we started to see evidence that barriers were not being managed consistently across our regions and team. We also realized that not all barriers could be demonstrated as fully functional,” Mr Bulgachev said.

“And, finally, we acknowledged that our barriers – as our operations – are too complex to manage effectively using just the current bowtie view model alone. For example, we didn’t clearly define what the barriers consisted of.” 

This thinking led the second revision effort to redesign the bowties, which BP rolled out in 2019.

Mr Bulgachev noted the two main principles that underlined this second redesign: Barriers should be independent, and they should be fully functional.

 First, they decided that a barrier could be considered independent if it has no common failure modes with other barriers on the same cause/consequence leg. Second, a barrier could be considered fully functional if it can – on its own – prevent a cause from developing into a risk event (prevention barrier) or completely mitigate the consequences of a risk event or reduce its severity (mitigation barrier).

The group also applied the “sense, act, demand” methodology. This means that a fully functional barrier should – by itself – sense a change in condition, decide what is required to be done to rectify the change, and then act accordingly to rectify this change. 

Mr Bulgachev said: “For example, for a well control response barrier, well monitoring and rig sensors detecting a kick is a ‘sense.’ The driller deciding to shut-in the well is a ‘decide.’ The BOP is activated and well kill procedures are fully engaged is ‘act.’ ”

The redesign effort led to the development of fully functional and, where possible, independent barriers. Each barrier was also broken down into critical tasks and critical equipment. These components were then grouped by distinct operations, such as tripping operations and monitor and control fluid weight.

“For critical components, we developed performance standards – descriptions of what should be in place for components to function as required,” Mr Bulgachev said. “Self-verification questions are designed to verify performance standards are being met.”

He added: “We also developed what we call barrier enablers. Enablers are the processes and systems which are not barriers themselves, but none of the barriers can function properly without the enablers in place.” Examples of enablers are Control of Work and Safe Operating Limits.

As a result of this second revision, the number of bowties was reduced from nine to six. “Revised bowties contained fewer barriers than the first revision, but the barriers became more complex, with all the components now clearly defined,” Mr Bulgachev said. 

BP also developed a digital self-verification app, which hosts the self-verification checklists for every critical task and equipment on the bowties. In addition to recording and tracking functions, it also has a dashboard showing the health of barriers and components in different colors. This helps reviewers to prioritize various actions for future resolution and to visualize improvement opportunities.

“The app shows only components relevant to specific rig types,” Mr Bulgachev said. “For example, the component list for land rigs doesn’t show marine risk components.”

BP is now preparing a third revision of the standard bowties for rollout in the near future, Mr Bulgachev said. One improvement he noted is clearly marking the components for rig verification only. “The health of those components won’t degrade in-between rig verifiers’ visits. Their removal from the wellsite leader scope can reduce their barrier self-verification workload by up to 30%.”

Other improvements being planned include additional app functionalities, such as operational and priority filters, as well as the implementation of a simplified structure for self-verification checklists. BP is also working to digitalize its annual self-verification plans. DC

This article is based on SPE/IADC 204132, presented at the 2021 SPE/IADC International Drilling Conference, held virtually on 8-12 March.